[dependabot]

Bumps the go group with 3 updates in the / directory: cel.dev/cel-go, github.com/duckdb/duckdb-go/v2 and google.golang.org/grpc.

Updates cel.dev/cel-go from 0.32.0 to 0.33.1

Release notes

Sourced from cel.dev/cel-go's releases.

Release v0.33.1

Cherry-picks for backwards compatibility with legacy timestamp and timezone formats, and support for google.protobuf.Value types as comprehension keys.

What's Changed

• Release v0.33.1 cherry-picks by @​TristonianJones in cel-expr/cel-go#1590

Full Changelog: cel-expr/cel-go@v0.33.0...v0.33.1

Release v0.33.0

This release introduces a high-performance Pratt parser, a unified declarative cost model (common/cost) with aggregate sizing and peak memory tracking, raw pointer traversal for native Go structs, and JSON/YAML parsing extensions, while eliminating quadratic type-checking bottlenecks.

Features

Pull Request	Description and Impact
Pratt parser and EnablePrattParser option (#1427, #1433, #1442, #1462, #1472, #1497, #1509, #1511, #1521)	Introduces a recursive-descent Pratt parser ported from cel-cpp with iterative parenthesis handling, bounded expression nesting, and escaped function name support, delivering 8x–19x faster single-threaded parsing.
Unified cost model (common/cost), AggregateSizingStrategy, and CostModelVersion (#1430, #1435, #1441, #1474, #1478, #1482, #1512, #1519, #1525, #1537, #1548, #1556, #1558)	Unifies static cost estimation and runtime tracking under a declarative cost.OverloadModel AST with container Key/Elem size propagation, aggregate sizing, value-backed ElemOf/KeyOf/ElemTotal/KeyTotal/Length combinators, and versioned compatibility via cel.CostModelVersion.
Runtime peak memory tracking (#1418, #1429)	Adds runtime memory tracking and scaled string/byte sizing options to observe and bound peak allocation footprints during evaluation.
Native raw pointer traversal, generic containers, and type aliasing (#1463, #1498, #1503, #1515)	Accelerates cel.NativeTypes struct field selection and presence checks via unsafe.Pointer offset traversal, adds generic Go slice/map adapters, and supports native type aliasing.
JSON/YAML parsing and encoding & URL-safe Base64 (#1451, #1461, #1492)	Adds json.parse, yaml.parse, and yaml.encode extensions (returning optional_type with 10MB payload safety limits), alongside base64.encodeUrl and base64.decodeUrl in ext.Encoders.
List presence helpers and versioned optional macros (#1447, #1448, #1487)	Introduces hasOnly, hasAny, hasAll, and hasExactly in ext.Lists, optional.hasValue(val) in OptionalTypesVersion(3), and single-evaluation optMap/optFlatMap macros in OptionalTypesVersion(4).
HMAC digest and constant-time equality (#1450)	Extends ext/security/hmac with hmac.digest and linear-time equality comparisons.
Late-bound functions from Activation (#1483)	Enables resolving cel.FunctionVars bindings dynamically from the runtime Activation or cel.Globals.
Type-check error suggestions and cel.Env JSON serialization (#1500, #1554)	Adds edit-distance spellchecking and library enablement hints for undeclared symbols/types, plus JSON/YAML config serialization for cel.Env.
AST structural equivalence and @block call tagging (#1467, #1544)	Provides format-insensitive AST structural comparison in common/ast and tags cel.@block calls in compiled ASTs.
SLSA + Sigstore artifact signing and OSS-Fuzz consolidation (#1426, #1577)	Signs release artifacts with SLSA/Sigstore provenance and consolidates OSS-Fuzz harnesses under fuzzing/.

Fixes

Pull Request	Impact and Technical Details
Undo failed assignability checks in place (#1575)	Replaces full type-mapping clones during overload resolution with an in-place undo log, eliminating O(N^2) type-checking latency and memory growth on long conjunctions (#1553).
Restore v0.32.0 cost behavior at CostModelVersion(0) and v0.29.2 cost limit error (#1571, #1572, #1573)	Restores EvalCancelledError ("operation cancelled: actual cost limit exceeded") when runtime cost limits are exceeded and replays v0.32.0 static/runtime cost rules when pinned to cel.CostModelVersion(0).
Fix unsafe math and saturation in cost estimation and tracking (#1508, #1541)	Adds SafeSubtract, SafeTrunc, and SafeMultiplyByFactorTrunc in common/cost so uint64 and float-scaled costs saturate cleanly at math.MaxUint64 (including NaN) and clamp negative values to 0.
Nil-safe Program evaluation and concurrent cost tracker race fix (#1480, #1484, #1486, #1488)	Makes Eval, ContextEval, and ConcurrentEval nil-safe, eliminates a data race when capturing cost trackers across goroutines, and removes time-based flakiness in interrupt checks.
Constant folding and partial evaluation AST consistency (#1446, #1453, #1517, #1518)	Prunes folded nodes from reference and type maps, checks unknowns before traversing attribute qualifiers, and fixes custom Foldable two-variable iteration.
Native types embedded json:"-" tags and proto.ReflectMessage dereference (#1452, #1551, #1567)	Respects json:"-" skip tags on embedded Go structs, fixes JSON tag conversion in ConvertToNative, and prevents invalid field dereferences over proto.ReflectMessage.
Fix regex counted repetition sizing panic (#1438)	Prevents a panic when estimating compiled regex program sizes for counted repetitions.

Breaking Changes

There are no module path changes in this release, but callers relying on exact AST expansion shapes, golden cost estimates, or positional SizeEstimate literals should note:

1. Cost Model v1 Default (cel.CostModelVersion): cel.CostModelVersion(1) is now the default and tightens static/runtime cost bounds (propagating optional and container element sizes, charging 1 on absent optional qualifiers, and normalizing rational scale factors). Callers requiring exact v0.32.0 cost compatibility can pin cel.CostModelVersion(0).
2. Optional Types v4 Default (cel.OptionalTypes): Unpinned cel.OptionalTypes() now defaults to OptionalTypesVersion(4), which wraps non-identifier optMap/optFlatMap targets in a single-evaluation comprehension (ComprehensionKind) rather than duplicating the target in a ternary call (CallKind), and includes optional.hasValue(val) from v3. Pin cel.OptionalTypes(cel.OptionalTypesVersion(2)) to preserve legacy AST expansion and cost estimates.
3. cost.SizeEstimate Struct Fields: cost.SizeEstimate (aliased by checker.SizeEstimate) now includes Key *SizeEstimate and Elem *SizeEstimate fields to track container element sizing. Unkeyed positional struct literals (SizeEstimate{0, 10}) must be updated to keyed literals (SizeEstimate{Min: 0, Max: 10}) or cost.FixedSizeEstimate / cost.RangedSizeEstimate.

Notes on Performance

... (truncated)

Commits

• fd8eb23 Release v0.33.1 cherry-picks (#1590)
• f99b2fe Fix presence perf regression (#1578)
• 4ab6aed Lint fixes for deprecations, best practices (#1579)
• 73b80a7 Merge pull request #1577 from dmitriplotnikov/fuzzing
• f4595e5 Consolidate OSS-Fuzz and internal fuzz targets in fuzzing package
• da49767 Fix failing BenchmarkCheck cases (#1576)
• 840daca Replay v0.32.0 costs at version 0; fix optional sizing, call floor, and condi...
• e205d7a Restore v0.32.0 cost behavior at ModelVersion(0) (#1573)
• e3e6964 Updates to the 'Length' estimation reasoning (#1570)
• 7aa73b1 Undo failed assignability checks in place (#1575)
• Additional commits viewable in compare view

Updates github.com/duckdb/duckdb-go/v2 from 2.10506.0 to 2.20000.0

Release notes

Sourced from github.com/duckdb/duckdb-go/v2's releases.

v2.20000.0

[!IMPORTANT] Upgrades to DuckDB v2.0.0 through duckdb-go-bindings v0.20000.0. The native libraries now come from go.duckdb.org, so setups that restrict GOPROXY must allow it. The Go API is unchanged, but some behavior changes with DuckDB v2: RowsAffected for CREATE TABLE AS, profiling metrics, and dropped rows after a failed appender flush. Custom dynamic and static linking changed too. See Upgrading to DuckDB v2 in the README.

What's Changed

• fix: stop the interrupter goroutine when the wrapped call panics by @​hellower in duckdb/duckdb-go#190
• fix: bind nil elements of LIST and ARRAY parameters by @​hellower in duckdb/duckdb-go#191
• fix: bind nil composites as NULL and reject invalid values by @​mlafeldt in duckdb/duckdb-go#196
• Clarify parameter restrictions in multi-statement queries by @​mlafeldt in duckdb/duckdb-go#198
• Fix missing newlines in table UDF examples by @​mlafeldt in duckdb/duckdb-go#199
• Fix UUID sign bit when constructing bound values by @​mlafeldt in duckdb/duckdb-go#200
• Reject named arguments as positional binding fallbacks by @​mlafeldt in duckdb/duckdb-go#201
• Preserve the local calendar date when encoding DATE by @​mlafeldt in duckdb/duckdb-go#202
• Reject out-of-range DATE values instead of silently wrapping them by @​mlafeldt in duckdb/duckdb-go#203
• Update CI actions and golangci-lint by @​mlafeldt in duckdb/duckdb-go#205
• Run CI on Namespace runners to avoid hours-long queues by @​mlafeldt in duckdb/duckdb-go#206
• Skip macOS x64 tests on PRs by @​mlafeldt in duckdb/duckdb-go#211
• Reject Clear calls on closed appenders by @​mlafeldt in duckdb/duckdb-go#212
• Simplify CI runner and platform setup by @​mlafeldt in duckdb/duckdb-go#214
• Upgrade to DuckDB v2 by @​mlafeldt in duckdb/duckdb-go#217

Full Changelog: duckdb/duckdb-go@v2.10506.0...v2.20000.0

Commits

• bb8380a Merge pull request #217 from mlafeldt/duckdb-v2-bindings
• cd69e0f Document that a failed AppendRow does not append its row
• 76fd883 Verify the shared library the dynamic lib tests download
• 554d7ae Document upgrading to DuckDB v2
• c936ff5 Test dynamic and static linking against the bindings' DuckDB build
• 7863d1a Report dropped appender rows on Close until Clear acknowledges them
• 1ce76d5 Read profiling metrics from DuckDB v2's metric groups
• b4db755 Match DuckDB v2's query logging in TestLogStorage
• bc675d8 Expect CREATE TABLE AS to report its rows as affected
• 725eb6c Return nil for typed NULL UDF arguments instead of aborting
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions